As soon as you confirm or strongly suspect infection, disconnect from the internet. Unplug Ethernet. Switch on Airplane mode. Disconnect from mobile hotspot. This prevents malware from: downloading additional payloads, communicating with command-and-control servers, uploading your stolen data to attackers, and spreading to other devices on your network. As McAfee's January 2026 guidance states: "Cutting the internet connection hinders malicious activities from communicating with a remote host, sending confidential information or downloading further threats." Do not reconnect until scans are fully complete and malware removed.

Before any removal tools run, copy your most critical files — important documents, irreplaceable photos, business data — to an external drive or USB. Do this before scanning, not after. Some removal processes quarantine or delete files that appear suspicious; some malware removal triggers further instability. Back up documents and data files only — do not back up .exe files from an infected machine, as malware can be embedded within executables and would carry over.

Safe Mode starts Windows with only essential system processes — most malware is designed to run after normal startup and will not load in Safe Mode. Running scans from Safe Mode means malware cannot actively interfere with the removal process, cannot re-enable itself during scanning, and cannot block security tools from functioning. This is particularly important if malware has already disabled Windows Defender in normal mode.

Clearing temporary files removes many cached malware components, speeds up scanning, and is recommended by Dell, Microsoft, and security researchers as a standard pre-scan step. Many malware installers leave traces in Temp folders that can re-infect even after a scan if not cleared first.

Windows Defender (Windows Security) is built into Windows 10 and 11 at no cost. A Full Scan examines every file on your system — much more thorough than the default Quick Scan which only checks common infection locations. Microsoft recommends running from Safe Mode for best results on suspected active infections. Additionally, run the Offline Scan — this scans before Windows loads and catches boot-sector malware and rootkits that standard scans miss.

No single antivirus detects everything. Malwarebytes Free is the most widely recommended second-opinion scanner in the cybersecurity industry — specialising in adware, PUPs, browser hijackers, and spyware that Windows Defender sometimes misses. It runs alongside Windows Defender without conflict and has been the go-to free second-opinion tool for security professionals for over a decade. Only download from malwarebytes.com — many fake "Malwarebytes" downloads are themselves malware.

Some infections — particularly rootkits and advanced persistent threats — hide deeply in the system and survive standard antivirus scans. For infections that return after removal or persist despite two rounds of scanning, use these specialist tools recommended by cybersecurity professionals.

After system-level malware is removed, check your browser separately. Browser hijackers often survive system scans because they live within browser profile data rather than system files. This step is required even if the system scan found and removed threats.

If a keylogger was present, every password typed while the device was infected has been captured and may already be in use by an attacker, or actively being sold on the dark web. Change all passwords from a different device — your phone, a trusted friend's laptop, a cyber café machine you trust. Priority order: 1) Gmail/Email (controls recovery for everything else), 2) M-Pesa and banking, 3) Work systems and email, 4) Social media, 5) Everything else. Enable Two-Factor Authentication (2FA) on all important accounts — even if a password is stolen, 2FA blocks the attacker from actually logging in.